Newsletters
The Enterprise Security Supersite NewsFactor Sites:       NewsFactor.com     Enterprise Security Today     CRM Daily     Business Report     Sci-Tech Today  
   
This ad will display for the next 20 seconds. Click for more information, or
Home Network Security Viruses & Malware Cybercrime Security Solutions More Topics...
GET RECOGNIZED.
Let an ISACA® certification
elevate your career.

Register today and save
Network Security
DDoS Protection Powered By Verisign
Average Rating:
Rate this article:  
83 Safari Patches: Could Rise of Apple Affect Enterprise Security?

83 Safari Patches: Could Rise of Apple Affect Enterprise Security?
By Jennifer LeClaire

Share
Share on Facebook Share on Twitter Share on Linkedin Share on Google Plus

"There are a couple of takeaways from this -- the first being that Apple products are 'hacker proof' is a myth," said analyst Marcus Carey. "With the bring-your-own-device movement gaining steam in IT enterprises, there are many organizations that have Apple products appearing in their networks without the tools to manage them."
 


The "bring your own device" movement is gaining major momentum. That's why Apple's latest round of patches may concern enterprise IT admins.

Apple on Monday updated Safari to version 5.1.4 as it patched a whopping 83 vulnerabilities. It's a record for Safari 5, and the fact that 72 of the flaws were rated critical didn't help ease the concern. The saving grace: None of the vulnerabilities has been exploited in attacks. But mobile industry watchers are still concerned about the ripple effect.

"The consumerization of enterprise mobility -- most visibly manifested by the BYOD trend -- has now moved on to the application front," said Philippe Winthrop, mobility analyst and founder of the Enterprise Mobility Forum. "Organizations are now quickly recognizing the power and value of providing mobile applications to both their employees and their customers. Despite this, many companies are still faced with the challenge of striking the balance between maintaining security and control for IT, while preserving the user-experience of the device for the employee."

Was Apple Pwned?

Although Apple also improved JavaScript performance in its Safari 5.1.4 update, as well as enhanced search field responsiveness, and fixed some interfaces for viewing Flash content after zooming in, most industry watchers are focusing on security.

"Since Safari and Chrome both use WebKit, the open-source browser engine, it allows Apple to reap the benefits of Google's web bounty program, which is responsible for the majority of the Safari WebKit-related fixes," said Marcus Carey, security researcher at Rapid7. "The timing of these patches also comes on the heels of CanSecWest Pwn2Own and Google's Pwnium competitions, where researchers try to research and exploit browser bugs."

Whenever there are new products announced from Apple, people should always expect tons of updates containing security fixes, product enhancements, and of course Apple's ever-changing EULA, Carey said. Shortly after he saw the new iPad announcement, he started noticing prompts for updating software and agreeing to new terms on his Apple products.

"There are a couple of takeaways from this -- the first being that Apple products are 'hacker proof' is a myth. With the bring-your-own-device movement gaining steam in IT enterprises, there are many organizations that have Apple products appearing in their networks without the tools to manage them," Carey said. "Even just allowing employees to install iTunes on their machines exposes the organization to Safari/WebKit vulnerabilities."

Usability vs. Security

According to Forrester Research, 60 percent of U.S. companies have already established bring-your-own-device programs. The knee-jerk reaction among employers is to lock down end-point devices by adding additional security software, restricting functionality, and requiring long and complicated passwords to access the device.

Users, however, don't want to have to enter a password just to access Facebook, be restricted to which apps they can download, or limited in which functions they can use. Smartphone adoption -- the impetus behind BYOD -- has been driven by the user experience, a fact that is forcing companies to look for a new balance between usability and security.

"IT managers are saddled with the task of figuring out how to manage proprietary corporate content without sacrificing security and the end-users' experience with their mobile devices," said Naeem Zafar, CEO and president of Bitzer Mobile. "Device management solutions miss the point. It's not about managing a device; it's about securing the flow of the data."
 

Tell Us What You Think
Comment:

Name:

Lee:

Posted: 2012-03-14 @ 2:42am PT
I think everyone's missing the point of this article. Apple has had it easy up until now because they had so little of the market, they weren't targeted much. Now that their market share is growing and they're becoming more present in enterprise environments that aren't prepared for them through BYOD schemes, they will be targeted more. These patches have been released, but if they haven't been applied, users are still vulnerable, so in enterprises where there are no systems in place to monitor this, you are exposed. Let's not forget that the exploit that conficker took advantage of had been patched before conficker was released, but unpatched systems meant it still spread.

joberele:

Posted: 2012-03-13 @ 6:54pm PT
This article is best described as a pack of FUD.

PhillyG:

Posted: 2012-03-13 @ 4:23pm PT
I don't understand how installing iTunes creates a security risk if iTunes is only used to communicate with Apple and Apple's iCloud.

GC:

Posted: 2012-03-13 @ 3:36pm PT
Why is it that every story about computer security focuses on the wrong metric. The number of patches is a meaningless number because it does not answer the more important question. How many unpatched vulnerabilities remain? If anything a large number of patches should be considered a good thing since it means that there are that many fewer to worry about.

Anyway, it's the amount of exploits in the wild that is the more meaningful number and in that respect Apple is winning hands down.

Don108:

Posted: 2012-03-13 @ 3:10pm PT
There are over a million pieces of malware for Windows in the field. Many pieces of Windows malware can install and run themselves with no users involvement. Malware for Linux is much better, but still there. There is only a handful of malware for the Mac, and most requires user actions to install and run. Now, Apple has fixed POTENTIAL openings to malware before any was even detected.

Your complaint in this article is like complaining about the quality of a pane of glass in a window while your entire house is burning down.



Salesforce.com is the market and technology leader in Software-as-a-Service. Its award-winning CRM solution helps 82,400 customers worldwide manage and share business information over the Internet. Experience CRM success. Click here for a FREE 30-day trial.


 Network Security
1.   Target Data Breach Cost: $148 Million
2.   Aruba Handles Black Hat with Aplomb
3.   Chinese Hackers Steal Patient Data
4.   FBI Cybersquad To Add Agents
5.   Apple Opens China iCloud Data Center


advertisement
Target Data Breach Cost: $148 Million
Better customer data protection needed.
Average Rating:
Aruba Handles Black Hat with Aplomb
Network firm sees 2,376 DoS attacks.
Average Rating:
FBI Cybersquad To Add Agents
Rewarded for recent security successes.
Average Rating:
Product Information and Resources for Technology You Can Use To Boost Your Business

Network Security Spotlight
Cost of Target Data Breach: $148 Million Plus Loss of Trust
The now infamous Target data breach is still costing the company -- and its shareholders -- plenty. In fact, the retailing giant forecast the December 2013 incident cost shareholders $148 million.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 
Chinese Hackers Nab Info on Millions of U.S. Patients
A group of Chinese hackers has stolen the personal information, including names and Social Security numbers, of about 4.5 million patients at hospitals operated by Community Health Systems.
 

Enterprise Hardware Spotlight
Three New Lenovo PCs Aimed at Business Users
Businesses everywhere want computing solutions that do more for less money, and Lenovo has unveiled three new desktop PCs that offer solid computing at a budget-minded price.
 
Aruba Networks Handles Black Hat with Aplomb
It's not an easy job. Aruba Networks' task throughout the Black Hat USA conference in Las Vegas this month was to ensure thousands of attendees could connect without malicious attacks.
 
Compression, Deduplication Come to Violin Concerto 2200
Violin Memory has announced that data deduplication and compression capabilities are now available on its Concerto 2200 solution. Typically, users will experience deduplication rates between 6:1 and 10:1.
 

Mobile Technology Spotlight
Apple Stock Soars Ahead of iPhone 6 Launch
The imminent release of the iPhone 6 -- and maybe even an iWatch -- has sent Apple's stock soaring to new heights. Considering what else the firm could have up its sleeve -- the stratosphere may be the limit.
 
HTC Debuts Windows Phone Version of One M8 Smartphone
HTC is bringing the Windows Phone mobile OS to its flagship One M8 device -- the first time any mainstream flagship smartphone has been offered with a choice of operating systems.
 
Verizon Earns Top Rating in Mobile Network Comparison
A new report says Verizon Wireless was the top-performing U.S. cellphone service provider in the first half of 2014, on a nationwide and state-by-state basis, as well as in metro areas.
 

Navigation
Enterprise Security Today
Home/Top News | Network Security | Viruses & Malware | Cybercrime | Security Solutions | Mobile Security | Disaster Recovery | Windows Security
Data Security | EST Press Releases
NewsFactor Network Enterprise I.T. Sites
NewsFactor Technology News | Enterprise Security Today | CRM Daily

NewsFactor Business and Innovation Sites
Sci-Tech Today | NewsFactor Business Report

NewsFactor Services
FreeNewsFeed | Free Newsletters

About NewsFactor Network | How To Contact Us | Article Reprints | Careers @ NewsFactor | Services for PR Pros | Top Tech Wire | How To Advertise

Privacy Policy | Terms of Service
© Copyright 2000-2014 NewsFactor Network. All rights reserved. Article rating technology by Blogowogo. Member of Accuserve Ad Network.